The invention relates generally to thrust controls for aircraft engines, and more specifically to a thrust control system to promptly correct a thrust control malfunction, thereby ensuring that no single fault of an aircraft""s propulsion control system will result in an unaccommodated thrust control malfunction.
Malfunctions in aircraft power plant thrust control systems can result in uncontrollable high engine power levels that are potentially hazardous or catastrophic for aircraft operation. A particularly hazardous situation is when a thrust control system failure results in one of the aircraft""s engines continuing to operate at a high power condition and not responding to a throttle command to reduce power during takeoff, approach or landing. Typically, when this failure mode occurs, the actual thrust either increases to a significantly higher than commanded thrust and/or remains at a high level when the thrust levers are set for low thrust. If one engine fails to respond to a command to reduce power, a high asymmetric thrust condition occurs, creating a high lateral force on the aircraft that is very difficult for a pilot to control. Even if the asymmetry can be controlled, the excess thrust may cause the airplane""s stopping distance to exceed the available runway length. In such cases, exceptional skills and prompt flight crew action may not be adequate to avoid risks to aircraft safety.
Some recent thrust limiting systems have reduced the potential for this failure mode to occur, but have not eliminated the risk. Known limiting systems include automatic engine shutdown and thrust cutback features, but are designed to be activated only if the engine rotor speed exceeds specified levels. These levels will not necessarily be exceeded in the event of a thrust control malfunction. Increased traffic and congestion, as well as the increased use of parallel taxiways and runways have increased the potential for an aircraft experiencing such a failure to impact other aircraft, ground support equipment, or a terminal. Thus, such a failure could potentially impact the occupants of multiple aircraft, terminal spaces, and/or ground support personnel.
Therefore, it would be desirable to implement an automatic thrust control malfunction accommodation system that would automatically detect a failure of an aircraft engine to throttle down when idle or low thrust is selected, and mitigate the failure by automatically reducing engine power. Such a system would ensure that no single fault of an aircraft""s propulsion control system will result in an unaccommodated thrust control malfunction. It would also be desirable to implement such a system in existing aircraft design by exploiting the resources of the existing engine control system without adding any major new components.
In one preferred embodiment the present invention is directed to a system and method for detecting and correcting a thrust control malfunction in an aircraft engine. The system includes an electronic engine control (EEC) unit that includes a first processing subsystem and a second processing subsystem, and a thrust control malfunction accommodation (TCMA) circuit included in the first processing subsystem and the second processing subsystem. Additionally, the system includes a TCMA software package executed by the first processing subsystem and the second processing subsystem, thereby providing redundant execution of the TCMA software package.
The method of the present invention compares the engine""s actual power level with a threshold contour defined by the TCMA software package. When the TCMA software package determines that a thrust control malfunction has occurred, based on the engine""s power level exceeding the threshold contour, the engine is shut down by the TCMA circuit.
The present invention is still further directed to an electronic engine control (EEC) unit configured to detect and correct an aircraft engine thrust control malfunction using an active-active functionality. The EEC includes a first processing subsystem for unilaterally monitoring engine operation and shutting down the engine when a thrust control malfunction occurs, and a second processing subsystem for unilaterally monitoring engine operation and shutting down the engine when a thrust control malfunction occurs.